summaryrefslogtreecommitdiffstats
path: root/drivers (follow)
Commit message (Collapse)AuthorAgeFilesLines
* Merge tag 'pinctrl-v3.14-2' of ↵Linus Torvalds2014-02-086-15/+32
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl Pull pinctrl fixes from Linus Walleij: "First round of pin control fixes for v3.14: - Protect pinctrl_list_add() with the proper mutex. This was identified by RedHat. Caused nasty locking warnings was rootcased by Stanislaw Gruszka. - Avoid adding dangerous debugfs files when either half of the subsystem is unused: pinmux or pinconf. - Various fixes to various drivers: locking, hardware particulars, DT parsing, error codes" * tag 'pinctrl-v3.14-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: pinctrl: tegra: return correct error type pinctrl: do not init debugfs entries for unimplemented functionalities pinctrl: protect pinctrl_list add pinctrl: sirf: correct the pin index of ac97_pins group pinctrl: imx27: fix offset calculation in imx_read_2bit pinctrl: vt8500: Change devicetree data parsing pinctrl: imx27: fix wrong offset to ICONFB pinctrl: at91: use locked variant of irq_set_handler
| * pinctrl: tegra: return correct error typeLaxman Dewangan2014-02-061-1/+1
| | | | | | | | | | | | | | | | When memory allocation failed, drive should return error as ENOMEM. Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com> Acked-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: do not init debugfs entries for unimplemented functionalitiesFlorian Vaussard2014-02-061-2/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit c420619 "pinctrl: pinconf: remove checks on ops->pin_config_get" removed the check on (ops != NULL) when performing pinconf_pins_show() or pinconf_groups_show(). As these entries are always enabled, even if pinconf is not supported, reading will result in an oops due to NULL ops. Instead of checking for ops, remove the corresponding debugfs entries if pinconf and/or pinmux are not implemented. Tested on OMAP3 (pinctrl-single). Cc: stable@vger.kernel.org Signed-off-by: Florian Vaussard <florian.vaussard@epfl.ch> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: protect pinctrl_list addStanislaw Gruszka2014-02-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have few fedora bug reports about list corruption on pinctrl, for example: https://bugzilla.redhat.com/show_bug.cgi?id=1051918 Most likely corruption happen due lack of protection of pinctrl_list when adding new nodes to it. Patch corrects that. Fixes: 42fed7ba44e ("pinctrl: move subsystem mutex to pinctrl_dev struct") Cc: stable@vger.kernel.org Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com> Acked-by: Stephen Warren <swarren@nvidia.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: sirf: correct the pin index of ac97_pins groupQipan Li2014-02-031-1/+1
| | | | | | | | | | | | | | | | | | according to datasheet and ac97_muxmask assignment, ac97_pins should be corrected. Signed-off-by: Qipan Li <Qipan.Li@csr.com> Signed-off-by: Barry Song <Baohua.Song@csr.com> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: imx27: fix offset calculation in imx_read_2bitChris Ruehl2014-02-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | The offset for the 2bit register calculate wrong, this patch fixes the problem. The debugfs printout for oconf, iconfa, iconfb now shows the real values. Cc: stable@vger.kernel.org Signed-off-by: Chris Ruehl <chris.ruehl@gtsys.com.hk> Reviewed-by: Markus Pargmann <mpa@pengutronix.de> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: vt8500: Change devicetree data parsingTony Prisk2014-02-031-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Due to an assumption in the VT8500 pinctrl driver, the value passed from devicetree for 'wm,pull' was not explicitly translated before being passed to pinconf. Since v3.10, changes to 'enum pin_config_param', PIN_CONFIG_BIAS_PULL_(UP/DOWN) no longer map 1-to-1 with the expected values in devicetree. This patch adds a small translation between the devicetree values (0..2) and the enum pin_config_param equivalent values. Cc: <stable@vger.kernel.org> # v3.10+ Signed-off-by: Tony Prisk <linux@prisktech.co.nz> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: imx27: fix wrong offset to ICONFBChris Ruehl2014-02-031-4/+4
| | | | | | | | | | | | | | | | | | | | | | The offset to ICONFB was incorrect, this patch set the correct value 0x14. dev_dbg in function imx1_write_2bit print the wrong address and had been moved after address calculation. Cc: stable@vger.kernel.org Signed-off-by: Chris Ruehl <chris.ruehl@gtsys.com.hk> Reviewed-by: Markus Pargmann <mpa@pengutronix.de> Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
| * pinctrl: at91: use locked variant of irq_set_handlerNicolas Ferre2014-02-031-5/+5
| | | | | | | | | | | | | | | | | | | | When setting the gpio irq type, use the __irq_set_handler_locked() variant instead of the irq_set_handler() to prevent false spinlock recursion warning. Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com> Cc: stable <stable@vger.kernel.org> # v3.12 Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
* | watchdog: dw_wdt: Add dependency on HAS_IOMEMRichard Weinberger2014-02-081-0/+1
| | | | | | | | | | | | | | | | | | | | | | On archs like S390 or um this driver cannot build nor work. Make it depend on HAS_IOMEM to bypass build failures. drivers/built-in.o: In function `dw_wdt_drv_probe': drivers/watchdog/dw_wdt.c:302: undefined reference to `devm_ioremap_resource' Signed-off-by: Richard Weinberger <richard@nod.at> Signed-off-by: Wim Van Sebroeck <wim@iguana.be>
* | Merge branch 'v4l_for_linus' of ↵Linus Torvalds2014-02-0731-71/+83
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media Pull media fixes from Mauro Carvalho Chehab: "A series of small fixes. Mostly driver ones. There is one core regression fix on a patch that was meant to fix some race issues on vb2, but that actually caused more harm than good. So, we're just reverting it for now" * 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media: [media] adv7842: Composite free-run platfrom-data fix [media] v4l2-dv-timings: fix GTF calculation [media] hdpvr: Fix memory leak in debug [media] af9035: add ID [2040:f900] Hauppauge WinTV-MiniStick 2 [media] mxl111sf: Fix compile when CONFIG_DVB_USB_MXL111SF is unset [media] mxl111sf: Fix unintentional garbage stack read [media] cx24117: use a valid dev pointer for dev_err printout [media] cx24117: remove dead code in always 'false' if statement [media] update Michael Krufky's email address [media] vb2: Check if there are buffers before streamon [media] Revert "[media] videobuf_vm_{open,close} race fixes" [media] go7007-loader: fix usb_dev leak [media] media: bt8xx: add missing put_device call [media] exynos4-is: Compile in fimc-lite runtime PM callbacks conditionally [media] exynos4-is: Compile in fimc runtime PM callbacks conditionally [media] exynos4-is: Fix error paths in probe() for !pm_runtime_enabled() [media] s5p-jpeg: Fix wrong NV12 format parameters [media] s5k5baf: allow to handle arbitrary long i2c sequences
| * | [media] adv7842: Composite free-run platfrom-data fixMartin Bugge2014-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | Incorrectly setting of free-run for Composite. Copy/paste regression fix. Signed-off-by: Martin Bugge <marbugge@cisco.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] v4l2-dv-timings: fix GTF calculationMartin Bugge2014-02-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Round off image width to nearest 8 (GTF_CELL_GRAN) A source sending a GTF (Generalized Timing Formula) format have no means of signalling image width. The assumed aspect ratio may result in an odd image width but according to the standard image width should be in multiple of 8. Cc: Mats Randgaard <matrandg@cisco.com> Signed-off-by: Martin Bugge <marbugge@cisco.com> Reviewed-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] hdpvr: Fix memory leak in debugMasanari Iida2014-02-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | cppcheck reported memory leak in device_authorizatio() within hdpvr-core.c. When the debug option is specified and the code jump to "unlock:" label, print_buf was not freed. Confirm the module succesfully compiled without error. Signed-off-by: Masanari Iida <standby24x7@gmail.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] af9035: add ID [2040:f900] Hauppauge WinTV-MiniStick 2Antti Palosaari2014-02-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add USB ID [2040:f900] for Hauppauge WinTV-MiniStick 2. Device is build upon IT9135 chipset. Tested-by: Stefan Becker <schtefan@gmx.net> Signed-off-by: Antti Palosaari <crope@iki.fi> Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] mxl111sf: Fix compile when CONFIG_DVB_USB_MXL111SF is unsetDave Jones2014-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix the following build error: drivers/media/usb/dvb-usb-v2/ mxl111sf-tuner.h:72:9: error: expected ‘;’, ‘,’ or ‘)’ before ‘struct’ struct mxl111sf_tuner_config *cfg) Signed-off-by: Dave Jones <davej@fedoraproject.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] mxl111sf: Fix unintentional garbage stack readDave Jones2014-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | mxl111sf_read_reg takes an address of a variable to write to as an argument. drivers/media/usb/dvb-usb-v2/mxl111sf-gpio.c:mxl111sf_config_pin_mux_modes passes several uninitialized stack variables to this routine, expecting them to be filled in. In the event that something unexpected happens when reading from the chip, we end up doing a pr_debug of the value passed in, revealing whatever garbage happened to be on the stack. Change the pr_debug to match what happens in the 'success' case, where we assign buf[1] to *data. Spotted with Coverity (Bugs 731910 through 731917) Signed-off-by: Dave Jones <davej@fedoraproject.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Cc: stable@vger.kernel.org Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] cx24117: use a valid dev pointer for dev_err printoutAndi Shyti2014-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Don't use '&state->priv->i2c->dev' reference to device because state is still 'NULL'. Use '&i2c->dev' instead. This bug has been reported by scan.coverity.com Signed-off-by: Andi Shyti <andi@etezian.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Cc: vger@stable.kernel.org Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] cx24117: remove dead code in always 'false' if statementAndi Shyti2014-02-041-8/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | At this point of the execution in the function cx24117_attach() demod cannot be '0'. In that case the function returns earlier with an error value ('NULL'). Remove the if statement. This error has been reported by scan.coverity.com Signed-off-by: Andi Shyti <andi@etezian.org> Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] update Michael Krufky's email addressMichael Krufky2014-02-0416-19/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | I am no longer available at the kernellabs.com or m1k.net email addresses. Update each instance of my email to my linuxtv.org account. Signed-off-by: Michael Krufky <mkrufky@linuxtv.org> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] vb2: Check if there are buffers before streamonRicardo Ribalda2014-02-041-0/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch adds a test preventing streamon() if there is no buffer ready. Without this patch, a user could call streamon() before preparing any buffer. This leads to a situation where if he calls close() before calling streamoff() the device is kept streaming. Signed-off-by: Ricardo Ribalda Delgado <ricardo.ribalda@gmail.com> Reviewed-by: Marek Szyprowski <m.szyprowski@samsung.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] Revert "[media] videobuf_vm_{open,close} race fixes"Hans Verkuil2014-02-043-19/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit a242f426108c284049a69710f871cc9f11b13e61. That commit actually caused deadlocks, rather then fixing them. If ext_lock is set to NULL (otherwise videobuf_queue_lock doesn't do anything), then you get this deadlock: The driver's mmap function calls videobuf_mmap_mapper which calls videobuf_queue_lock on q. videobuf_mmap_mapper calls __videobuf_mmap_mapper, __videobuf_mmap_mapper calls videobuf_vm_open and videobuf_vm_open calls videobuf_queue_lock on q (introduced by above patch): deadlocked. This affects drivers using dma-contig and dma-vmalloc. Only dma-sg is not affected since it doesn't call videobuf_vm_open from __videobuf_mmap_mapper. Most drivers these days have a non-NULL ext_lock. Those that still use NULL there are all fairly obscure drivers, which is why this hasn't been seen earlier. Since everything worked perfectly fine for many years I prefer to just revert this patch rather than trying to fix it. videobuf is quite fragile and I rather not touch it too much. Work is (slowly) progressing to move everything over to vb2 or at the very least use non-NULL ext_lock in videobuf. Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Cc: <stable@vger.kernel.org> # for v3.11 and up Cc: Al Viro <viro@ZenIV.linux.org.uk> Reported-by: Pete Eberlein <pete@sensoray.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] go7007-loader: fix usb_dev leakAlexey Khoroshilov2014-02-041-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is usb_get_dev() in go7007_loader_probe(), but there is no usb_put_dev() anywhere. Found by Linux Driver Verification project (linuxtesting.org). Signed-off-by: Alexey Khoroshilov <khoroshilov@ispras.ru> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] media: bt8xx: add missing put_device callLevente Kurusa2014-02-041-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is required so that we give up the last reference to the device. Remove the kfree() because the put_device() call will actually call release_sub_device which in turn kfrees the device. Signed-off-by: Levente Kurusa <levex@linux.com> Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] exynos4-is: Compile in fimc-lite runtime PM callbacks conditionallySylwester Nawrocki2014-02-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enclose the runtime PM helpers in #ifdef CONFIG_PM_RUNTIME/#endif to avoid following compile warning when CONFIG_PM_RUNTIME is disabled: CC drivers/media/platform/exynos4-is/fimc-lite.o drivers/media/platform/exynos4-is/fimc-lite.c:1591:12: warning: ‘fimc_lite_runtime_resume’ defined but not used [-Wunused-function] drivers/media/platform/exynos4-is/fimc-lite.c:1599:12: warning: ‘fimc_lite_runtime_suspend’ defined but not used [-Wunused-function] Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] exynos4-is: Compile in fimc runtime PM callbacks conditionallySylwester Nawrocki2014-02-041-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Enclose the runtime PM helpers in #ifdef CONFIG_PM_RUNTIME/#endif to avoid following compile warning when CONFIG_PM_RUNTIME is disabled: CC drivers/media/platform/exynos4-is/fimc-core.o drivers/media/platform/exynos4-is/fimc-core.c:1040:12: warning: ‘fimc_runtime_resume’ defined but not used drivers/media/platform/exynos4-is/fimc-core.c:1057:12: warning: ‘fimc_runtime_suspend’ defined but not used Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Reviewed-by: Jingoo Han <jg1.han@samsung.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] exynos4-is: Fix error paths in probe() for !pm_runtime_enabled()Sylwester Nawrocki2014-02-042-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Ensure clk_disable() is called on error paths only when clk_enable() was previously called. This fixes following build warning: .../media-git/drivers/media/platform/exynos4-is/fimc-lite.c: In function 'fimc_lite_probe': .../media-git/drivers/media/platform/exynos4-is/fimc-lite.c:1583:1: warning: label 'err_sd' defined but not used [-Wunused-label] Reported-by: Hans Verkuil <hansverk@cisco.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] s5p-jpeg: Fix wrong NV12 format parametersJacek Anaszewski2014-02-041-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | NV12 format entries in the sjpeg_formats array had wrong colplanes, depth and v_align values. Signed-off-by: Jacek Anaszewski <j.anaszewski@samsung.com> Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
| * | [media] s5k5baf: allow to handle arbitrary long i2c sequencesAndrzej Hajda2014-02-041-11/+19
| |/ | | | | | | | | | | | | | | | | | | | | | | Using variable length array in s5k5baf_write_arr_seq caused an implicit assumption that i2c sequences should be short. The patch rewrites the function so it can handle sequences of any length and does not use variable length array. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Andrzej Hajda <a.hajda@samsung.com> Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com> Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
* | Merge tag 'hwmon-for-linus' of ↵Linus Torvalds2014-02-072-36/+36
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging Pull hwmon fixes from Guenter Roeck: "Fix PMBus driver problem with some multi-page voltage sensors and fix da9055 interrupt initialization" * tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: hwmon: (da9055) Remove use of regmap_irq_get_virq() hwmon: (pmbus) Support per-page exponent in linear mode
| * | hwmon: (da9055) Remove use of regmap_irq_get_virq()Adam Thomson2014-02-071-4/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Remove use of regmap_irq_get_virq() in driver probe which was conflicting with use of platform_get_irq_byname(). platform_get_irq_byname() already returns the VIRQ number due to MFD core translation so using regmap_irq_get_virq() on that returned value results in an incorrect IRQ being requested. The driver probes then fail because of this. Signed-off-by: Adam Thomson <Adam.Thomson.Opensource@diasemi.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
| * | hwmon: (pmbus) Support per-page exponent in linear modeGuenter Roeck2014-02-031-32/+36
| |/ | | | | | | | | | | | | | | | | | | | | Some chips use different exponents for sensors on different pages or rails. Detect and store exponent per page to support this situation. This fixes a problem with wrong voltages seen on UCD90120. Reported-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Tested-by: Soren Brinkmann <soren.brinkmann@xilinx.com> Signed-off-by: Guenter Roeck <linux@roeck-us.net>
* | Merge tag 'pm+acpi-3.14-rc2' of ↵Linus Torvalds2014-02-077-23/+75
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm Pull ACPI and power management fixes from Rafael Wysocki: "These include a fix for a recent ACPI hotplug regression, four concurrency related fixes and one PCI device removal fix for ACPI-based PCI hotplug (ACPIPHP), intel_pstate fix that should go into stable, three simple ACPI cleanups and a new entry for the ACPI video blacklist. Specifics: - Fix for a recent ACPI hotplug regression causing a NULL pointer dereference to occur while handling ACPI eject notifications for already ejected devices. From Toshi Kani. - Four concurrency-related fixes for ACPIPHP. Two of them add missing locking and the other two fix race conditions related to reference counting. - ACPIPHP fix to avoid NULL pointer dereferences during device removal involving Virtual Funcions. - intel_pstate fix to make it compute the percentage of time the CPU is busy properly. From Dirk Brandewie. - Removal of two unnecessary NULL pointer checks in ACPI code and a fix for sscanf() format string from Dan Carpenter and Luis G.F. - New ACPI video blacklist entry for HP EliteBook Revolve 810 from Mika Westerberg" * tag 'pm+acpi-3.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: ACPI / hotplug: Fix panic on eject to ejected device ACPI / battery: Fix incorrect sscanf() string in acpi_battery_init_alarm() ACPI / proc: remove unneeded NULL check ACPI / utils: remove a pointless NULL check ACPI / video: Add HP EliteBook Revolve 810 to the blacklist intel_pstate: Take core C0 time into account for core busy calculation ACPI / hotplug / PCI: Fix bridge removal race vs dock events ACPI / hotplug / PCI: Fix bridge removal race in handle_hotplug_event() ACPI / hotplug / PCI: Scan root bus under the PCI rescan-remove lock ACPI / hotplug / PCI: Move PCI rescan-remove locking to hotplug_event() ACPI / hotplug / PCI: Remove entries from bus->devices in reverse order
| | \
| | \
| *-. \ Merge branches 'acpi-cleanup' and 'acpi-video'Rafael J. Wysocki2014-02-064-6/+10
| |\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * acpi-cleanup: ACPI / battery: Fix incorrect sscanf() string in acpi_battery_init_alarm() ACPI / proc: remove unneeded NULL check ACPI / utils: remove a pointless NULL check * acpi-video: ACPI / video: Add HP EliteBook Revolve 810 to the blacklist
| | | * | ACPI / video: Add HP EliteBook Revolve 810 to the blacklistMika Westerberg2014-02-051-0/+8
| | | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | On HP EliteBook Revolve 810 the ACPI backlight device doesn't work as expected. For example when resuming from system sleep, it seems to lose backlight settings. Forcing Intel driver fixes the problem so add this machine the ACPI video detect blacklist. Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| | * | ACPI / battery: Fix incorrect sscanf() string in acpi_battery_init_alarm()Luis G.F2014-02-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Fix incorrect sscanf() string in acpi_battery_init_alarm(). Change from %ld to %lu, because 'x' is unsigned long. Signed-off-by: Luis G.F <luisgf@luisgf.es> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| | * | ACPI / proc: remove unneeded NULL checkDan Carpenter2014-02-051-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We already verified that "ldev" was non-NULL earlier and also we dereference again without checking a three lines later. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| | * | ACPI / utils: remove a pointless NULL checkDan Carpenter2014-02-051-4/+0
| | |/ | | | | | | | | | | | | | | | | | | "element" can't be NULL because it is the address of a struct member. Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| * | Merge branch 'pm-cpufreq'Rafael J. Wysocki2014-02-061-4/+17
| |\ \ | | | | | | | | | | | | | | | | * pm-cpufreq: intel_pstate: Take core C0 time into account for core busy calculation
| | * | intel_pstate: Take core C0 time into account for core busy calculationDirk Brandewie2014-02-041-4/+17
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | Take non-idle time into account when calculating core busy time. This ensures that intel_pstate will notice a decrease in load. References: https://bugzilla.kernel.org/show_bug.cgi?id=66581 Cc: 3.10+ <stable@vger.kernel.org> # 3.10+ Signed-off-by: Dirk Brandewie <dirk.j.brandewie@intel.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| * | Merge branches 'acpi-pci-hotplug' and 'acpi-hotplug'Rafael J. Wysocki2014-02-061-2/+4
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | * acpi-pci-hotplug: ACPI / hotplug / PCI: Fix bridge removal race vs dock events ACPI / hotplug / PCI: Fix bridge removal race in handle_hotplug_event() ACPI / hotplug / PCI: Scan root bus under the PCI rescan-remove lock ACPI / hotplug / PCI: Move PCI rescan-remove locking to hotplug_event() ACPI / hotplug / PCI: Remove entries from bus->devices in reverse order * acpi-hotplug: ACPI / hotplug: Fix panic on eject to ejected device
| | * | ACPI / hotplug: Fix panic on eject to ejected deviceToshi Kani2014-02-051-2/+4
| | |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When an eject request is sent to an ejected ACPI device, the following panic occurs: ACPI: \_SB_.SCK3.CPU3: ACPI_NOTIFY_EJECT_REQUEST event BUG: unable to handle kernel NULL pointer dereference at 0000000000000070 IP: [<ffffffff813a7cfe>] acpi_device_hotplug+0x10b/0x33b : Call Trace: [<ffffffff813a24da>] acpi_hotplug_work_fn+0x1c/0x27 [<ffffffff8109cbe5>] process_one_work+0x175/0x430 [<ffffffff8109d7db>] worker_thread+0x11b/0x3a0 This is becase device->handler is NULL in acpi_device_hotplug(). This case was used to fail in acpi_hotplug_notify_cb() as the target had no acpi_deivce. However, acpi_device now exists after ejection. Added a check to verify if acpi_device->handler is valid for an eject request in acpi_hotplug_notify_cb(). Note that handler passed from an argument is still valid while acpi_device->handler is NULL. Fixes: 202317a573b2 (ACPI / scan: Add acpi_device objects for all device nodes in the namespace) Signed-off-by: Toshi Kani <toshi.kani@hp.com> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| * | ACPI / hotplug / PCI: Fix bridge removal race vs dock eventsRafael J. Wysocki2014-02-031-1/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a PCI bridge with an ACPIPHP context attached is removed via sysfs, the code path executed as a result is the following: pci_stop_and_remove_bus_device_locked pci_remove_bus pcibios_remove_bus acpi_pci_remove_bus acpiphp_remove_slots cleanup_bridge unregister_hotplug_dock_device (drops dock references to the bridge) put_bridge free_bridge acpiphp_put_context (for each child, under context lock) kfree (context) Now, if a dock event affecting one of the bridge's child devices occurs (roughly at the same time), it will lead to the following code path: acpi_dock_deferred_cb dock_notify handle_eject_request hot_remove_dock_devices dock_hotplug_event hotplug_event (dereferences context) That may lead to a kernel crash in hotplug_event() if it is executed after the last kfree() in the bridge removal code path. To prevent that from happening, add a wrapper around hotplug_event() called dock_event() and point the .handler pointer in acpiphp_dock_ops to it. Make that wrapper retrieve the device's ACPIPHP context using acpiphp_get_context() (instead of taking it from the data argument) under acpiphp_context_lock and check if the parent bridge's is_going_away flag is set. If that flag is set, it will return immediately and if it is not set it will grab a reference to the device's parent bridge before executing hotplug_event(). Then, in the above scenario, the reference to the parent bridge held by dock_event() will prevent free_bridge() from being executed for it until hotplug_event() returns. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| * | ACPI / hotplug / PCI: Fix bridge removal race in handle_hotplug_event()Rafael J. Wysocki2014-02-031-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If a PCI bridge with an ACPIPHP context attached is removed via sysfs, the code path executed as a result is the following: pci_stop_and_remove_bus_device_locked pci_remove_bus pcibios_remove_bus acpi_pci_remove_bus acpiphp_remove_slots cleanup_bridge put_bridge free_bridge acpiphp_put_context (for each child, under context lock) kfree (child context) Now, if a hotplug notify is dispatched for one of the bridge's children and the timing is such that handle_hotplug_event() for that notify is executed while free_bridge() above is running, the get_bridge(context->func.parent) in handle_hotplug_event() will not really help, because it is too late to prevent the bridge from going away and the child's context may be freed before hotplug_event_work() scheduled from handle_hotplug_event() dereferences the pointer to it passed via the data argument. That will cause a kernel crash to happpen in hotplug_event_work(). To prevent that from happening, make handle_hotplug_event() check the is_going_away flag of the function's parent bridge (under acpiphp_context_lock) and bail out if it's set. Also, make cleanup_bridge() set the bridge's is_going_away flag under acpiphp_context_lock so that it cannot be changed between the check and the subsequent get_bridge(context->func.parent) in handle_hotplug_event(). Then, in the above scenario, handle_hotplug_event() will notice that context->func.parent->is_going_away is already set and it will exit immediately preventing the crash from happening. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
| * | ACPI / hotplug / PCI: Scan root bus under the PCI rescan-remove lockRafael J. Wysocki2014-02-031-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | Since acpiphp_check_bridge() called by acpiphp_check_host_bridge() does things that require PCI rescan-remove locking around it, make acpiphp_check_host_bridge() use that locking. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
| * | ACPI / hotplug / PCI: Move PCI rescan-remove locking to hotplug_event()Rafael J. Wysocki2014-02-031-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 9217a984671e (ACPI / hotplug / PCI: Use global PCI rescan-remove locking) modified ACPIPHP to protect its PCI device removal and addition code paths from races against sysfs-driven rescan and remove operations with the help of PCI rescan-remove locking. However, it overlooked the fact that hotplug_event_work() is not the only caller of hotplug_event() which may also be called by dock_hotplug_event() and that code path is missing the PCI rescan-remove locking. This means that, although the PCI rescan-remove lock is held as appropriate during the handling of events originating from handle_hotplug_event(), the ACPIPHP's operations resulting from dock events may still suffer the race conditions that commit 9217a984671e was supposed to eliminate. To address that problem, move the PCI rescan-remove locking from hotplug_event_work() to hotplug_event() so that it is used regardless of the way that function is invoked. Revamps: 9217a984671e (ACPI / hotplug / PCI: Use global PCI rescan-remove locking) Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
| * | ACPI / hotplug / PCI: Remove entries from bus->devices in reverse orderRafael J. Wysocki2014-02-031-4/+4
| |/ | | | | | | | | | | | | | | | | | | | | | | | | | | | | According to the changelog of commit 29ed1f29b68a (PCI: pciehp: Fix null pointer deref when hot-removing SR-IOV device) it is unsafe to walk the bus->devices list of a PCI bus and remove devices from it in direct order, because that may lead to NULL pointer dereferences related to virtual functions. For this reason, change all of the bus->devices list walks in acpiphp_glue.c during which devices may be removed to be carried out in reverse order. Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Tested-by: Mika Westerberg <mika.westerberg@linux.intel.com>
* | Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linuxLinus Torvalds2014-02-0619-139/+1016
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull drm fixes from Dave Airlie: "A few regression fixes already, one for my own stupidity, and mgag200 typo fix, vmwgfx fixes and ttm regression fixes, and a radeon register checker update for older cards to handle geom shaders" * 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: drm/radeon: allow geom rings to be setup on r600/r700 (v2) drm/mgag200,ast,cirrus: fix regression with drm_can_sleep conversion drm/ttm: Don't clear page metadata of imported sg pages drm/ttm: Fix TTM object open regression vmwgfx: Fix unitialized stack read in vmw_setup_otable_base drm/vmwgfx: Reemit context bindings when necessary v2 drm/vmwgfx: Detect old user-space drivers and set up legacy emulation v2 drm/vmwgfx: Emulate legacy shaders on guest-backed devices v2 drm/vmwgfx: Fix legacy surface reference size copyback drm/vmwgfx: Fix SET_SHADER_CONST emulation on guest-backed devices drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls" drm/vmwgfx: Don't commit staged bindings if execbuf fails drm/mgag200: fix typo causing bw limits to be ignored on some chips
| * | drm/radeon: allow geom rings to be setup on r600/r700 (v2)Dave Airlie2014-02-063-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | the evergreen CS parser has allowed this for a while, just port the code to the r600 one. This is required before geom shaders can be made work. v2: agd5f: minor cleanup and add additional 7xx reg. Signed-off-by: Dave Airlie <airlied@redhat.com> Signed-off-by: Alex Deucher <alexander.deucher@amd.com> Signed-off-by: Dave Airlie <airlied@redhat.com>
| * | Merge tag 'vmwgfx-fixes-3.14-2014-02-05' of ↵Dave Airlie2014-02-0610-130/+988
| |\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://people.freedesktop.org/~thomash/linux into drm-next A couple of vmwgfx fixes together with missing bits of legacy device emulation to facilitate old user-space drivers on new devices. The shader emulation bits are a bit large, but since they mostly touch the new device code, regressions are unlikely. I figure the gain of having this from the start clearly outweighs the risc of adding these bits at this point. Pull request of 2014-02-05 * tag 'vmwgfx-fixes-3.14-2014-02-05' of git://people.freedesktop.org/~thomash/linux: vmwgfx: Fix unitialized stack read in vmw_setup_otable_base drm/vmwgfx: Reemit context bindings when necessary v2 drm/vmwgfx: Detect old user-space drivers and set up legacy emulation v2 drm/vmwgfx: Emulate legacy shaders on guest-backed devices v2 drm/vmwgfx: Fix legacy surface reference size copyback drm/vmwgfx: Fix SET_SHADER_CONST emulation on guest-backed devices drm/vmwgfx: Fix regression caused by "drm/ttm: make ttm reservation calls behave like reservation calls" drm/vmwgfx: Don't commit staged bindings if execbuf fails
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-23 03:51:20 +0100